JP2000004221A - Data communication system and its controlling method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To reduce the load of the entire system by producing a session key only with a 1st device and notifying it to a 2nd device. SOLUTION: A host device 2 as an external device reads transaction data DT0 which is for producing a session key of this time from IC data 1 and an enciphering part 22 produces an initial session key Key 0 by using a master key MK managed by the device 2, based on it. On the device 2 side, the part 22 enciphers a message that is exchanged with an IC card 1, produces a message authentication code MAC based on it, enciphers it and transmits it to the card 1. When a prescribed processing is completed, the device 2 produces new data that takes the place of the data DT0 and writes it on the card 1. Also, the device 2 produces a session key Key 1 that is next used by using the key MK through the part 22 and transmits it to the card 1.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a data communication system used at the time of a transaction executed between a host device and a plurality of IC cards, and more particularly to a data communication system using a session key and a control method thereof. .

[0002]

2. Description of the Related Art Conventionally, when performing data communication in a data communication system including a host and a terminal, the data is encrypted using predetermined key data (session key data) in order to enhance the security of the transmitted data. Data communication is performed by using a technique of transmitting the data.

[0003] In recent years, in order to further enhance security, it has been considered that data communication is performed by using a technique of encrypting and transmitting session key data used for encrypting data. I have.

[0004] Among them, the operation of the session key is as follows.
It is conceivable to use the session key used last time and the session key data used this time differently.
In general, when data is exchanged between a plurality of devices, it is considered that a transmission message is encrypted and an authentication code is added in order to guarantee its security and validity.

[0005] By making the key data for encryption used in this case different each time as described above,
A method of preventing impersonation of a legitimate person by improper person is adopted.

[0006] In this case, both devices that exchange data must know in advance how to convert the key data. Therefore, for example, when the conversion method is changed, both devices must be changed.

[0007]

As described above, when data is transmitted and received between a plurality of devices, in order to guarantee the security and validity of the data, when encrypting the transmission message and adding an authentication code, In addition, a method is employed in which the encryption key data to be used is made different each time to prevent an unauthorized person from impersonating a legitimate person.

However, in this case, since both devices that transmit and receive data must know in advance how to convert the key data, in order to prevent spoofing,
When the conversion method is changed, both devices have to be changed, and there is a problem that the load on the entire system is large.

Therefore, the present invention has been made in view of the above points, and a session key is generated only by a first device and is notified to a second device. The data read from the second device is used for generation, and the next session key is generated with data different from the read data, and a new session key is set in the second device together with this data. It is an object of the present invention to provide a data communication system device and a control method thereof, which can reduce the burden on the entire system.

[0010]

According to the present invention, in order to solve the above-mentioned problems, (1) data communication for performing data communication between a first device and a second device using a session key; In the system, a current session key is generated only on the first device side using data read from the second device, and the second device and the second device are generated based on the generated current session key. A first means for communicating;
At the end of the communication by the means, the next session key is generated only on the first device side with variable data different from the data read from the second device, and the variable data and the generated next session are generated. Key to the second
And a second means for setting in the device.

According to the present invention, there is provided a data communication system for performing data communication between a first device and a second device by using a session key. Using the data read from the second device, a current session key is generated only on the first device side, and a message and a message authentication code encrypted based on the generated current session key are generated. First means for transmitting to the second device, and, at the end of communication by the first means, the next session key with variable data different from data read from the second device. And a second means for setting the variable data and the generated next session key in the second device. Data communication system is provided.

According to the present invention, there is provided a data communication system for performing data communication between a first device and a second device using a session key. Using the data read from the second device, a current session key is generated only on the first device side, and a message and a message authentication code encrypted based on the generated current session key are generated. The first means for transmitting to the second device and the second device confirming the encrypted message authentication code by the first means based on the initial session key owned by the second device. A second means for restoring the encrypted message to obtain the message, and a data read from the second device at the end of the communication by the first and second means. Third means for generating the next session key only in the first device using variable data different from the data, and setting the variable data and the generated next session key in the second device; There is provided a data communication system comprising:

According to the present invention, there is provided a data communication system for performing data communication between a first device and a second device using a session key. A first session key is generated only on the first device side using the data read from the second device, and a first session key communicating with the second device is generated based on the generated current session key. Means and the first
At the end of the communication by the means, the next session key is generated only on the first device side with variable data different from the data read from the second device, and the variable data and the generated next session are generated. A second means for transmitting to the second device a next session key and a message authentication code encrypted based on the next session key for which the key has been generated. Is provided.

According to the present invention, there is provided a data communication system for communicating data between a first device and a second device using a session key. A first session key is generated only on the first device side using the data read from the second device, and a first session key communicating with the second device is generated based on the generated current session key. Means and the first
At the end of the communication by the means, the next session key is generated only on the first device side with variable data different from the data read from the second device, and the variable data and the generated next session are generated. Second means for transmitting the next session key and the message authentication code encrypted based on the next session key for which the key has been generated, to the second device; A third means for restoring the next session key encrypted by the second means on the basis of the initial session key being obtained to obtain a next session key. A system is provided.

According to the present invention, there is provided a data communication system for performing data communication between a first device and a second device using a session key. Using the data read from the second device, a current session key is generated only on the first device side, and a message and a message authentication code encrypted based on the generated current session key are generated. The first means for transmitting to the second device and the confirmation of the encrypted message authentication code by the first means based on the initial session key owned by the second device. And second means for restoring the encrypted message to obtain a message, and reading from the second device at the end of communication by the first and second means. The next session key is generated only on the first device side with variable data different from the data, and the variable data and the generated next session key are encrypted based on the generated next session key. The next session key and message authentication code are stored in the second
The third means for transmitting to the second device and the initial session key owned by the second device itself to restore the next session key encrypted by the third means. And a fourth means for obtaining a next session key.

According to the present invention, there is provided a data communication system for performing data communication between a first device and a second device by using a session key. A first session key is generated only on the first device side using the data read from the second device, and a first session key communicating with the second device is generated based on the generated current session key. And when the communication in the first step is completed, the next session key is generated only by the first device using variable data different from the data read from the second device, and the variable data And a second step of setting the generated next session key in the second device. .

According to the present invention, there is provided a data communication system for performing data communication between a first device and a second device using a session key. Using the data read from the second device, a current session key is generated only on the first device side, and a message and a message authentication code encrypted based on the generated current session key are generated. A first step of transmitting to the second device, and, at the end of the communication in the first step, the next session key with variable data different from the data read from the second device. Side only,
And a second step of setting the variable data and the generated next session key in the second device.

According to the present invention, there is provided a data communication system for performing data communication between a first device and a second device using a session key. Using the data read from the second device, a current session key is generated only on the first device side, and a message and a message authentication code encrypted based on the generated current session key are generated. The first step of transmitting to the second device and the first device confirming the encrypted message authentication code based on the initial session key owned by the second device. And a second step of restoring the encrypted message to obtain a message, and at the end of the communication in the first and second steps,
A next session key is generated only on the first device side with variable data different from data read from the device, and the variable data and the generated next session key are set in the second device. 3. A method for controlling a data communication system, comprising the steps of:

According to the present invention, there is provided a data communication system for performing data communication between a first device and a second device using a session key. A first session key is generated only on the first device side using the data read from the second device, and a first session key communicating with the second device is generated based on the generated current session key. And when the communication in the first step is completed, the next session key is generated only by the first device using variable data different from the data read from the second device, and the variable data The next session key generated and the next session key encrypted based on the generated next session key and the message authentication code are transmitted to the first The control method of a data communication system, characterized by comprising a second step, the to be transmitted to the apparatus is provided.

According to the present invention, there is provided a data communication system for performing data communication between a first device and a second device using a session key. A first session key is generated only on the first device side using the data read from the second device, and a first session key communicating with the second device is generated based on the generated current session key. And when the communication in the first step is completed, the next session key is generated only by the first device using variable data different from the data read from the second device, and the variable data The next session key generated and the next session key encrypted based on the generated next session key and the message authentication code are transmitted to the first A second step of transmitting to the device, the second
The third device obtains the next session key by restoring the next session key encrypted by the second means based on the initial session key owned by the device itself.
And a control method for a data communication system, comprising the steps of:

According to the present invention, there is provided a data communication system for performing data communication between a first device and a second device by using a session key. Using the data read from the second device, a current session key is generated only on the first device side, and a message and a message authentication code encrypted based on the generated current session key are generated. A first step of transmitting to the second device, and confirming the encrypted message authentication code by the first means based on an initial session key owned by the second device. Performing the second step of restoring the encrypted message to obtain a message, and, upon completion of the communication by the first and second means, A next session key is generated only on the first device side with variable data different from the read data, and the variable data and the generated next session key are encrypted based on the generated next session key. Transmitting the next session key and the message authentication code to the second device, and the third device based on the initial session key owned by the second device. And a fourth step of restoring the next session key encrypted by the step to obtain the next session key.

[0022]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS First, a data communication system using a session key to which a data communication system according to the present invention is applied, for example, an example applied to a system including a host device, a terminal, and an IC card will be described with reference to the drawings. This will be described in detail with reference to FIG.

FIG. 1 is a block diagram for explaining the outline of the present system. That is, in FIG. 1, the host device 2 communicates with the CPU 3 for controlling the operation of each element constituting the host device 2, the non-volatile memory 21 for storing various information, and the terminal 3. A communication interface 203 to be performed, a keyboard 204 for a user to input data, instructions, and the like, and a CR for displaying calculation results, communicated data, and the like.
A display 205 made of T, an encryption module (hereinafter, referred to as an encryption unit) 22 for encrypting transmitted data, and a decryption module (hereinafter, referred to as a composite unit) for decrypting received data. 23.

The terminal 3 has a CPU 301 for controlling the operation of each element constituting the terminal 3,
A memory 302 for storing various information; a communication interface 303 for communicating with the host device 2;
A reader / writer 304 for reading and writing data from and to the cards 1 and 4 is provided.

The IC cards 1 and 4 include a CPU 101 for controlling the operation of each element constituting the IC card.
401, nonvolatile memories 11 and 14 for storing various kinds of information, and contact portions 103 and 403 for electrically connecting to the reader / writer 304 of the terminal 3.
And encryption units 14 and 44 for encrypting transmitted data
And decoding units 12 and 42 for decoding received data
Consists of

Next, in order to speed up the understanding of the outline of a data communication system using a session key in the above-described configuration, the above-described conventional processing flow will be described with reference to FIG.

That is, FIG. 2 shows that the data stored in advance in the memory 11 of the IC card 1 is read by the host device 2, the data is updated by the host device 2, and the updated data is transmitted to the IC card 1. By sending
The flow of a conventional process for updating data in the memory 11 of the IC card 1 is shown.

First, in this system, it is previously planned to use "xxx" as a transmission session key.
In FIG. 2, an IC card 1 is inserted into a reader / writer 304 of a terminal 3 to communicate with a host device 2, and communication between the two becomes possible.

The IC card 1 and the host device 2 are provided with nonvolatile memories 11 and 21, respectively.
These nonvolatile memories 11 and 21 have an initial stage,
For example, at the time of factory shipment or at the stage when an IC card is issued to a user, a predetermined transmission session key xxx is stored.

Similarly, a predetermined transmission session key xxxx
Are also stored in the nonvolatile memory 41 of the other IC card 4. When the IC card 1 can communicate with the host device 2 via the terminal 3, a first session key 1 generated from a random number generator (not shown) provided in the host device 2 transmits a transmission session key xxx. Is used as an encryption key by the encryption unit 22 to encrypt the session key.
It is encrypted as 1 '.

The encrypted session key 1 ′ is
The first session key 1 is transmitted to the IC card 1 via the terminal 3 and decrypted by the decryption unit 12 using the transmission session key xxx stored in the memory 11 in advance. .

After this operation, the transmission session key xxx stored in the memory 11 is replaced with the first session key.
It is rewritten to key1. When performing a transaction using the IC card 1, at this stage the IC card 1
The data M1 stored therein is read out together with the card ID and transmitted to the host device 2.

The data M1 and the card ID are stored in the memory 1
The encrypted data (M1 + ID) 'is transmitted to the host device 2 by being encrypted by the encryption unit 14 using the first session key key1 stored in the storage device 1 as an encryption key.

As described above, in the IC card 1, the data (M1 + ID) 'encrypted by using the first session key 1 received from the host device 2 is transmitted to the host device 2, so that the data is transmitted in the middle of the transmission. Even if the encrypted data is received by three parties, it cannot be decrypted by a third party who does not have the first session key 1.

Then, the encrypted data (M1 + I
D) ′ is decrypted by the decryption unit 23 in the host device 2 to extract the data M1 and the card ID. The card ID is compared with an ID registered in advance in the host device 2 to confirm the validity of the card 1.

When the card 1 is confirmed to be valid, the data M1 is calculated using, for example, the transaction data input from the terminal 3, so that the updated data M2 is calculated.

Thus, the operation of session 1 is completed. Subsequently, the operation of session 2 is started. Session 2
Then, the second session key-key 2 generated from the random number generator (not shown) provided in the host device 2 is encrypted by the encryption unit 22 using the first session key-key 1 as an encryption key. Thus, the encrypted session key 2 'is transmitted to the IC card 1.

In the IC card 1, the first session key
Using the key1 as a decryption key, the decryption unit 12 decrypts the encrypted session key key2 ', and a second session key2 is extracted.

After this operation, the first session key 1 stored in the memory 11 is replaced with the second session key 2. Next, the data M2 updated by the host device 2 has the same second session key-ke.
The encrypted update data M2 'is transmitted to the IC card 1 by being encrypted by the encryption unit 22 using y2, and is decrypted by the decryption unit 12 using the second session key 2.

In the IC card 1, the update data M2 is stored in the nonvolatile memory 11. Thus, the operation of the session 2 ends. As described above, the IC card 1
The session keys stored in the memory 11 are rewritten one after another.

When the subsequent session is not performed in the IC card 1, the transmission session key xxxx
Is transmitted from the host device 2 to the IC card 1, and the process ends.

When the end of the session is detected on the host device 2 side, the key xxx stored in the nonvolatile memory 21 is read out, and the encryption is performed by the encryption unit 22 using the second session key 2 as the encryption key. Transmission session key xx
× ′.

This encrypted transmission session key xxxx '
Is transmitted to the decryption unit 12 of the IC card 1, but this decryption can be performed only by the IC card 1 holding the session key key2 used in the immediately preceding session 2.

The decrypted transmission session key xxxx is
It is stored in the memory 11 in preparation for the next session. Next, sessions 3 and 4 between the same host device 2 and another IC card 4 will be described.

As described above, the same transmission session key xxx is stored in the nonvolatile memory 41 of the IC card 4 in advance. When the IC card 4 is inserted into the terminal 3 and data can be transmitted and received between the host device 2 and the IC card 4, the third session key generated from the random number generator is generated as in the case of the IC card 1. key3
Is encrypted with the key xxx, and the decryption unit 4 of the IC card 4
2 is transmitted.

The decrypted third session key key3
Are stored in the memory 43 and used as an encryption key for encrypting the data M3 and the card ID. Data M
3 and the card ID are encrypted by the third session key 3 and transmitted from the encryption unit 44 to the host device 2 and updated by, for example, transaction data input from the terminal 3 to generate an update message M4. .

The update data M4 is encrypted using the fourth session key 4, transmitted to the IC card 4, decrypted by the fourth session key 4, and stored.

Finally, the transmission session key xxx is the fourth
, And is sent to the IC card 4 and stored in the memory 41. However, in the processing flow of the data communication system as described above, when data is transmitted and received between a plurality of devices, in order to guarantee the security and legitimacy of the data, encryption of the transmission message and addition of an authentication code are required. In order to prevent impersonation by a fraudulent person, a method is adopted in which the key data used for encryption is made different each time. Since the conversion method must be known in advance, if the conversion method is changed in order to prevent spoofing, both devices must be changed, which poses a problem that the burden on the entire system is large. Was.

Next, the main part of the present invention which can solve such a problem will be described. FIG.
Shows a usage mode of a session key for explaining the main part of the present invention.

Prior to the implementation, the IC card 1 is provided with an initial session key Key0 to be used for the first time, for example, I
This is set when the C card is issued. The initial session key Key0 is the transaction data DT set in the IC card 1 together with the initial session key Key0.
This is the result of encrypting 0 with the master key MK managed by the system.

First, the host device 2 as an external device is
The transaction data DT0 for generating the current session key is read from the IC card 1, and based on this, the master key M managed by the host device 2 itself is read.
Using K, the initial session key Key0 is encrypted by the encryption unit 22.
Generated by

On the basis of this, on the side of the host device 2 as an external device, the encryption unit 22 encrypts a message exchanged with the IC card 1 and generates a message authentication code MAC.

In FIG. 3, M-1 is a message transmitted from the host device 2 as an external device to the IC card 1. First, the host device 2 as an external device encrypts the message M-1 using the initial session key Key0 to obtain M-1 ', and further encrypts the message authentication code MAC to generate MAC (Key0). This is set as M-1 '+ MAC (Key 0) and the IC card 1
To be transmitted.

The IC card 1 uses the M-1 '+ MAC
When (Key0) is received, the decryption unit 1 based on the initial session key Key0 owned by the IC card 1 itself.
Then, the message authentication code MAC is confirmed in step 2, and if it is determined that the message authentication code MAC is valid, the encrypted message M-1 'is restored to obtain the message M-1.

Now, when one kind of processing is completed,
The host device 2 as an external device generates new data DT1 in place of the transaction data DT0, and writes this to the IC card 1.

In FIG. 3, the new data DT1 is transmitted to the IC card 1 without being encrypted.
A message authentication code MAC based on the initial session key Key0 may be added and transmitted.

On the basis of this, the host device 2 as an external device generates a session key Key1 to be used next by the encryption unit 22 using the master key MK managed by the host device 2 itself, and generates this by the IC card. Transmit to 1.

At this time, the host device 2 as an external device
Performs the encryption of the session key Key1 to be used next and the addition of the message authentication code MAC in the same manner as described above, and obtains I1 + MAC (Key0) as I
Transmit to C card 1.

The IC card 1 uses this Key1 '+ MAC
When (Key0) is received, the initial session key Key is received.
0, the decryption unit 12 restores the next session key Key1 to be used, and restores the initial session key Key0.
Is rewritten to the session key Key1 to be used next.

Thereafter, the host device 2 as an external device
Generates the session key Keyn to be used next by the encryption unit 22 based on the transaction data DTn.

When the processing is completed, the host device 2 as an external device sets new data DTn + 1 in place of the transaction data DTn and a session key Keyn + 1 to be used next in the IC card 1.

On the IC card 1 side, an authentication code for DTn is generated based on the session key Keyn so that the host device 2 as an external device determines the validity of the transaction data DTn. May be output to the host device 2.

In this example, the host device 2 as an external device generates a session key to be used next based on the variable data DTn. However, the host device 2 generates the session key in combination with card-specific data in the IC card 1. It may be.

Data communication between the host device 2 as an external device and another IC card 4 using a session key is performed in the same manner as described above. As described above, according to the processing flow of the main part of the present invention, the external device generates a session key based on the data from the IC card and uses it for the subsequent encryption processing, Generates a session key to be used next based on data different from the previous session key, and sets these in the IC card.

[0065]

Therefore, as described in detail above, according to the present invention, the session key is generated only by the first device and is notified to the second device. By using the data read from the second device, generating the next session key with data different from the read data, and setting a new session key in the second device together with this data. It is possible to provide a data communication system and a control method thereof that can reduce the burden on the entire system.

[Brief description of the drawings]

FIG. 1 is a block diagram for explaining an outline of a system to which a data communication system according to the present invention is applied;

FIG. 2 is a diagram showing a conventional mode of using a session key applied to a system used for a transaction between a host device and an IC card in FIG. 1;

FIG. 3 is a diagram illustrating a use mode of a session key for explaining a main part of the present invention.

[Explanation of symbols]

 1, 4: IC card, 2: host device, 3: terminal, 11, 21, 41: memory, 12, 23: decryption unit, 14, 22: encryption unit.

Claims (12)

[Claims] 1. A data communication system for performing data communication between a first device and a second device using a session key, wherein a current session key is generated by using data read from the second device. Is generated only on the first device side, and a first means for communicating with the second device based on the generated current session key; and at the end of the communication by the first means, The next session key is generated only by the first device using variable data different from the data read from the second device, and the variable data and the generated next session key are set in the second device. A data communication system, comprising: 2. A data communication system for performing data communication between a first device and a second device using a session key, wherein a current session key is generated by using data read from the second device. Generating only on the first device side, and transmitting a message and a message authentication code encrypted based on the generated current session key to the second device; and At the end of the communication by the first means, the next session key is generated only by the first device with variable data different from the data read from the second device, and the variable data and the next generated key are generated. A second means for setting a session key in the second device. 3. A data communication system for performing data communication between a first device and a second device using a session key, wherein a current session key is generated using data read from the second device. Generating only the first device side, and transmitting a message and a message authentication code encrypted based on the generated current session key to the second device; and The second device confirms the encrypted message authentication code by the first means on the basis of the initial session key owned by itself and restores the encrypted message to obtain a second message. Means for communicating the next session key with variable data different from the data read from the second device at the end of communication by the first and second means. And a third means for generating the variable data and the generated next session key in the second device while generating the variable data only on one device side. 4. A data communication system for performing data communication between a first device and a second device using a session key, wherein a current session key is generated by using data read from the second device. Is generated only on the first device side, and a first means for communicating with the second device based on the generated current session key; and at the end of the communication by the first means, The next session key is generated only by the first device using variable data different from the data read from the second device, and the variable data and the generated next session key are generated by the next session key generated. And second means for transmitting a next session key and a message authentication code encrypted based on the second session key to the second device. Communications system. 5. A data communication system for performing data communication between a first device and a second device using a session key, wherein a current session key is generated by using data read from the second device. Is generated only on the first device side, and a first means for communicating with the second device based on the generated current session key; and at the end of the communication by the first means, The next session key is generated only by the first device using variable data different from the data read from the second device, and the variable data and the generated next session key are generated by the next session key generated. Second means for transmitting the next session key and the message authentication code encrypted based on the second device to the second device; A third means for restoring the next session key encrypted by the second means on the basis of the initial session key to obtain a next session key. . 6. A data communication system for performing data communication between a first device and a second device using a session key, wherein a current session key is generated using data read from the second device. Generating only the first device side, and transmitting a message and a message authentication code encrypted based on the generated current session key to the second device; and The second device confirms the encrypted message authentication code by the first means on the basis of the initial session key owned by itself and restores the encrypted message to obtain a second message. Means for ending the next session key with variable data different from the data read from the second device at the end of the communication by the first and second means. The first device only generates the next session key and the message authentication code encrypted based on the variable data and the generated next session key. A third means for transmitting to the second device, and a next session key encrypted by the third means, based on the initial session key owned by the second device. And a fourth means for obtaining a next session key. 7. A data communication system for performing data communication between a first device and a second device using a session key, wherein a current session key is generated by using data read from the second device. Generating only on the first device side and communicating with the second device based on the generated current session key; and The next session key is generated only by the first device using variable data different from the data read from the second device, and the variable data and the generated next session key are set in the second device. A control method for a data communication system, comprising: 8. A data communication system for performing data communication between a first device and a second device using a session key, wherein a current session key is generated by using data read from the second device. Generating only the first device side and transmitting a message and a message authentication code encrypted based on the generated current session key to the second device; and At the end of the communication in step 1, the next session key is generated only on the first device side with variable data different from the data read from the second device, and the variable data and the next generated key are generated. A second step of setting a session key in the second device. A method for controlling a data communication system, comprising: 9. A data communication system for performing data communication between a first device and a second device using a session key, wherein a current session key is generated using data read from the second device. Generating only on the first device side and transmitting a message and a message authentication code encrypted based on the generated current session key to the second device; and In the second step, based on the initial session key owned by the second apparatus, the first step checks the encrypted message authentication code and restores the encrypted message to obtain the second message. And at the end of the communication in the first and second steps, the next session with variable data different from the data read from the second device. And a third step of setting the variable data and the generated next session key in the second device while generating a session key only on the first device side. How to control the system. 10. A data communication system for performing data communication between a first device and a second device using a session key, wherein a current session key is generated using data read from the second device. Generating only on the first device side and communicating with the second device based on the generated current session key; and The next session key is generated only by the first device using variable data different from the data read from the second device, and the variable data and the generated next session key are generated by the next session key generated. Transmitting a next session key and a message authentication code encrypted based on the second step to the second device. A method for controlling a data communication system. 11. A data communication system for performing data communication between a first device and a second device using a session key, wherein a current session key is generated by using data read from the second device. Generating only on the first device side and communicating with the second device based on the generated current session key; and The next session key is generated only by the first device using variable data different from the data read from the second device, and the variable data and the generated next session key are generated by the next session key generated. Transmitting a next session key and a message authentication code encrypted based on the second device to the second device; and A third step of restoring the next session key encrypted by the second means to obtain the next session key based on the initial session key owned by the user. Control method for a data communication system. 12. A data communication system for performing data communication between a first device and a second device using a session key, wherein a current session key is generated by using data read from the second device. Generating only on the first device side and transmitting a message and a message authentication code encrypted based on the generated current session key to the second device; and The second device confirms the encrypted message authentication code by the first means on the basis of the initial session key owned by itself and restores the encrypted message to obtain a second message. And at the end of the communication by the first and second means, the next session with variable data different from the data read from the second device. And the next session key and the message authentication code encrypted based on the variable data and the generated next session key. A third step of transmitting to the second device, and restoring the next session key encrypted by the third step based on the initial session key owned by the second device. And a fourth step of obtaining a next session key.